The institution has disposal procedures for paper and electronic information with a single accountable owner, prohibits discarding sensitive paper with ordinary refuse, shreds on site or uses vetted disposal services under contracts that set acceptable procedures and with due diligence on the provider's staff screening, and makes data on drives, printers, fax machines, phones and other devices non-recoverable by overwriting, degaussing or physical destruction chosen by the sensitivity of the information, with policies, procedures and training that tell employees what to do.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.